Sanitize v1 router log inputs

[Copilot]

Canonical issue

Linked by issue metadata.

Outcome

Prevents CR/LF log forging from v1-router dynamic log values while preserving diagnostic context.

Scope

• Included:
  • Centralized _safe_log_value() for single-line log-safe rendering.
  • Applied sanitization to dynamic router log values: messages, session IDs, video/job/action/agent IDs, URLs, and exception text.
  • Added focused regressions for CR/LF escaping and non-string coercion.
• Explicitly excluded:
  • API behavior changes.
  • Production data/path changes.
  • Frontend/Vercel runtime changes.

Risk

• Risk level: low
• Failure mode: sanitized logs may show escaped control characters instead of raw formatting.
• Rollback: revert router sanitizer usage and focused tests.

Verification

Current head: d36b30415fba8ea9cf0392859d83a68019c7c379

• Focused tests: pytest tests/unit/test_v1_router_extended.py -q --no-cov → 146 passed, 2 warnings
• Required CI: PR Checks workflow is action_required before jobs are created; no failed-job logs available.
• Review threads resolved: parallel validation reported no review comments; CodeQL Python reported 0 alerts.

Production evidence

Not applicable: this changes Python backend logging and unit tests only; no frontend or deployment surface changed.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: sanitize v1 router log inputs (CWE-117) (PR #810) #913

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:58pm UTC